CPE
Termix-SSH Termix versions up to 2.9.2 are vulnerable to remote path traversal via the destPath argument in the /plugin-api/file-manager/transferToHost endpoint.